CVE-2026-47395

CVE-2026-47395 – PraisonAI CLI loopback/SSRF via @url: mentions Prior to PraisonAI v4.6.40 (and praisonaiagents v1.6.40), the direct-prompt CLI automatically expands @url:(http|https) prompts, performing an unrestricted urllib.request.urlopen() to the attacker-controlled URL. The fetched response...

CVE-2026-47395 PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, PraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins. If a prompt contains @url:, the CLI calls...

CVE-2026-65048

creationtimestamp| type| source ---|---|--- 2026-07-21 15:38:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr65bleqo52e 2026-07-23 01:01:27+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mrbn7txhu52l 2026-07-23 02:02:33+00:00| seen|...

CVE-2026-59846

creationtimestamp| type| source ---|---|--- 2026-07-21 14:35:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr5zrvgfjv2q...

CVE-2026-16402

creationtimestamp| type| source ---|---|--- 2026-07-21 13:57:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr5xnw5tvw23 2026-07-22 04:47:38+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260722 2026-07-22 18:42:04+00:00| seen|...

CVE-2026-64628

creationtimestamp| type| source ---|---|--- 2026-07-21 13:18:24+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5vhspcma2g...

SUSE CVE-2026-63896

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GETURL handling The WebUSB GETURL handler in compositesetup narrows landingpagelength to fit the host-supplied wLength using landingpagelength = wlength -...

Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues Update to version go1.25.12 bsc1244485. CVE-2026-25679: net/url: reject IPv6 literal not at start of host bsc1259264. CVE-2026-27139: os: FileInfo can escape from a Root bsc1259268. CVE-2026-27142: html/template: URLs in meta content...

GHSA-GCFJ-64VW-6MP9

creationtimestamp| type| source ---|---|--- 2026-07-21 12:01:32+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mr5r6e6l6b2h...

RUSTSEC-2026-0213 XSS in ammonia via SVG `animate` and `set` animation tags

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it. xml Click set Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs. Applications that do not...

CVE-2026-63896

A flaw was found in the Linux kernel's USB gadget composite driver. A remote attacker, acting as a malicious USB host, could send a specially crafted GETURL request. This request, with a small wLength value, triggers an integer underflow when calculating the buffer length for a memory copy...

CVE-2026-3182

creationtimestamp| type| source ---|---|--- 2026-07-21 10:20:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr5lkaulgz2q...

CVE-2026-3183

creationtimestamp| type| source ---|---|--- 2026-07-21 10:04:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr5knjvbvc24...

CVE-2026-63771

creationtimestamp| type| source ---|---|--- 2026-07-21 09:10:17+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mr5hm4swxy2o...

CVE-2026-9341

creationtimestamp| type| source ---|---|--- 2026-07-21 08:49:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr5ggei2pt2r...

CVE-2026-15691

creationtimestamp| type| source ---|---|--- 2026-07-21 08:48:01+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr5geceirq2p...

GHSA-9HW9-CH79-4VH6

creationtimestamp| type| source ---|---|--- 2026-07-21 06:31:17+00:00| seen| https://gist.github.com/alon710/c194376028b5fea9d1333b8a7894f724...

CVE-2023-37508

creationtimestamp| type| source ---|---|--- 2026-07-21 06:17:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr55wd6qbu27...

CVE-2026-15156

creationtimestamp| type| source ---|---|--- 2026-07-21 05:53:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr54n2liks2q...

CVE-2026-15927 Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an externalreference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validateexternalregistryurl. A repository...